Securing Windows Server: the basics that pay off
Most attacks on servers don't use sophisticated techniques — they exploit forgotten basics: exposed RDP, missing updates and over-privileged accounts. Here are the steps that cover the vast majority of the risk.
Contents
Updates: boring, but decisive
An unpatched server is the most common way in. Set a regular patch cycle — ideally with a test window and a scheduled restart outside business hours. Don't forget firmware and drivers, not just Windows.
Unattended auto-updates on a production server can cause damage. A sensible compromise is an approved cycle running shortly after patches ship.
The principle of least privilege
Every account should have only the rights it actually needs. Specifically:
- Don't use a domain admin for daily work — separate accounts for administration and for sign-in.
- Rename the local admin account and set a strong, unique password (ideally via LAPS).
- Service accounts should have no interactive logon and no more rights than the service requires.
RDP and remote access
RDP exposed straight to the internet is one of the most common causes of ransomware. Never leave it open to the whole world.
- Access only via VPN or RD Gateway, never directly.
- Enable multi-factor authentication.
- Restrict who may sign in over remote desktop.
Firewall and unnecessary services
A server should do one thing and do it well. Everything else is needless attack surface.
- Keep open only the ports the service truly needs.
- Disable roles and features you don't use.
- Separate server traffic from the ordinary client network.
Backup and recovery
Security is never absolute, so you need a plan B. Back up by the 3-2-1 rule and above all — test recovery regularly. A backup you've never restored is just hope.
Monitoring: know before your users do
Set alerts for critical events — failed logins, disk filling up, a service going down. The goal is simple: learn about a problem from monitoring, not from an angry user's phone call.
Want your server genuinely secure?
I'll review your server configuration and propose concrete steps to improve security. The initial consultation is free.
Book a consultation